{"record":{"id":"095955bbf80ed39c","repo":"apache/seatunnel","slug":"rabbitmq-08","errorCode":"RABBITMQ-08","errorMessage":"initialize ssl context failed","messagePattern":"initialize ssl context failed","errorType":"error_code","errorClass":"RabbitmqConnectorException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-rabbitmq/src/main/java/org/apache/seatunnel/connectors/seatunnel/rabbitmq/client/RabbitmqClient.java","lineNumber":111,"sourceCode":"     * @param queue blocking queue\n     * @param splitId split id\n     * @return consumer instance\n     */\n    public DefaultConsumer getQueueingConsumer(\n            BlockingQueue<DeliveryMessage> queue, String splitId) {\n        return new QueueingConsumer(channel, queue, splitId);\n    }\n\n    private ConnectionFactory createConnectionFactory() {\n        ConnectionFactory factory = new ConnectionFactory();\n        if (StringUtils.isNotEmpty(config.getUri())) {\n            try {\n                factory.setUri(config.getUri());\n            } catch (URISyntaxException e) {\n                throw new RabbitmqConnectorException(PARSE_URI_FAILED, e);\n            } catch (KeyManagementException e) {\n                // this should never happen\n                throw new RabbitmqConnectorException(INIT_SSL_CONTEXT_FAILED, e);\n            } catch (NoSuchAlgorithmException e) {\n                // this should never happen\n                throw new RabbitmqConnectorException(SETUP_SSL_FACTORY_FAILED, e);\n            }\n        } else {\n            factory.setHost(config.getHost());\n            factory.setPort(config.getPort());\n            if (StringUtils.isNotEmpty(config.getVirtualHost())) {\n                factory.setVirtualHost(config.getVirtualHost());\n            }\n            factory.setUsername(config.getUsername());\n            factory.setPassword(config.getPassword());\n        }\n\n        if (config.getAutomaticRecovery() != null) {\n            factory.setAutomaticRecoveryEnabled(config.getAutomaticRecovery());\n        }\n        if (config.getConnectionTimeout() != null) {","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-rabbitmq/src/main/java/org/apache/seatunnel/connectors/seatunnel/rabbitmq/client/RabbitmqClient.java#L93-L129","documentation":"When RabbitmqClient.createConnectionFactory sets a uri starting with amqps://, the underlying ConnectionFactory.setUri initializes SSL context material; a KeyManagementException there is wrapped in RabbitmqConnectorException with INIT_SSL_CONTEXT_FAILED ('initialize ssl context failed'). The code comment notes this 'should never happen' — it only occurs when the JVM's SSL/TLS environment is broken, e.g. no valid TLS algorithm or keystore issues.","triggerScenarios":"factory.setUri(config.getUri()) with an amqps:// URI throws KeyManagementException inside createConnectionFactory — typically when TLS provider/keystore initialization fails on the worker JVM.","commonSituations":"Misconfigured JVM security properties (jdk.tls.disabledAlgorithms disabling all TLS versions); corrupted or unreadable keystore/truststore; custom SecurityProvider conflicts; restricted crypto (JCE policy) in old JDKs.","solutions":["Inspect the wrapped KeyManagementException cause for the exact SSL init problem","Check JVM security config: java.security, jdk.tls.disabledAlgorithms, and that a valid TLS provider is available","Verify keystore/truststore paths and passwords passed via -Djavax.net.ssl.* system properties are correct and files readable","Upgrade to a supported JDK with healthy TLS defaults, or switch to a non-TLS amqp:// uri if TLS is not actually required","Test TLS from the worker node with a minimal Java snippet or openssl s_client -connect host:5671"],"exampleFix":"// before\njava ... -Djavax.net.ssl.trustStore=/wrong/path/cacerts\n// after\njava ... -Djavax.net.ssl.trustStore=/opt/jdk/lib/security/cacerts -Djavax.net.ssl.trustStorePassword=changeit","handlingStrategy":"try-catch","validationCode":"// pre-flight: verify TLS can be initialized on the worker JVM\ntry {\n    javax.net.ssl.SSLContext.getInstance(\"TLSv1.2\");\n    javax.net.ssl.SSLContext.getDefault();\n} catch (Exception e) {\n    throw new IllegalStateException(\"JVM TLS environment broken before RMQ amqps connection\", e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    new RabbitmqClient(config, ...);\n} catch (RabbitmqConnectorException e) {\n    if (e.getErrorCode() == RabbitmqConnectorErrorCode.INIT_SSL_CONTEXT_FAILED) {\n        LOG.error(\"SSL context init failed for amqps uri; check JVM TLS config/keystores\",\n                e.getCause());\n    } else throw e;\n}","preventionTips":["Verify the worker JVM can initialize SSLContext (no over-restrictive jdk.tls.disabledAlgorithms)","Check keystore/truststore files exist, are readable, and passwords are correct","Use a supported JDK with healthy TLS defaults","If TLS is not required, use amqp:// (non-TLS) uri or host/port config instead"],"tags":["rabbitmq","amqp","ssl","tls","uri"],"backgroundTag":"ssl-context-init-failed","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}